From address doesn't meet the authentication requirements defined for the sender

[#1]

Yet if an email is sent to a paid for Microsoft account then dkim passes without an issue.  Neither does how it is sent to microsoft if it is addressed to multiple addresses.

[#2]

@stuck 

My @@outlook and @Hotmail was successful 

Your @@outlook and @@live failed 

I will look to see if I have any @@live contacts.  This failure profile matches long known issues with Microsoft mail services - same email different targets - one gets a SCL of 6 (definitely spam) another 1 (definitely not spam).

[#3]

---

@Townman wrote:

...This failure profile matches long known issues with Microsoft mail services - same email different targets - one gets a SCL of 6 (definitely spam) another 1 (definitely not spam).

---

Really?  I'm sending one message to two people (one @live, the other @outlook) and BOTH copies bounce instantly.  Yet if I send one message to one person (at either @live or @oultook) those one-to-one messages are delivered.

Plus, this problem is new to me. It stared when MS introduced their new (draconian) requirements a few weeks ago.  Prior to that change I've been emailing these two recipients for years and years without any bounces.

So I ask again, given that I've configured my outgoing mail to require authentication and doing that is supposed to ensure DKIM, how come the bounces I get when I email two MS recipients says DKIM=fail?

[#4]

At the moment, I think it is unknown ... if the cause were known and within the bounds of Plusnet to do so, I think it would have been fixed!

In the reading around I have done on such matters, it is very evident that different Microsoft environments behave differently in respect of spam profiling.

To be crystal clear, if you send an email to BOTH, do BOTH reject / not receive the email?

[#5]

---

@Townman wrote:

To be crystal clear, if you send an email to BOTH, do BOTH reject / not receive the email?

---

I thought I'd already been crystal clear but I'll say it again for at least the third time...

If I create an email and put two addresses in the To field (one @live, the other @outlook) then when I click send I get two near instantaneous bounces.  One bounce says it rejecting the message to the @live address.  The other bounce is the rejection of the message to the @outlook address.  Apart from the mention of the different email addresses both bounces are identical and the key part of the rejection appears to be because 'DKIM=Fail'.

Yet if I create an email and only put one address in the To field (either the same @live one OR the same @outlook one that are rejected when used together) that message is delivered to the recipients Inbox.

I can provide the most recent versions of these bounces to you by PM but as I've already said, I'm fairly sure they are identical to the bounces messages I sent to you by PM way back at the start of this topic.

Clear enough now?

[#6]

Thank you yes - precision is important here when apparently similar testing successful.  I will see if I can find a pair of outlook and live contacts to attempt reproduction of the experience.

[#7]

@stuck I SUSPECT that when sending to multiple addresses , that this https://www.uriports.com/blog/outlook-com-dkim-temperror-in-dmarc-reports/ could be the problem. Microsoft seem to have some problem with DNS lookups for DKIM authentication. I've certainly seen to DKIM 'temperror' failures from Microsoft addresses in DMARC reports for my domain email ( not hosted by Plusnet ). In the case of my domain, where the volume of email is small, it doesnt matter since SPF still passes and thus the email is accepted.  Since Microsoft are now treating all <account>.plus.com domains as a single domain and thus as a 'bulk sender' , they are insisting that both DKIM & SPF pass. If they are failing DKIM lookups , then DKIM will fail and thus the email will get bounced.

Bottom line is that Microsoft need to fix their DKIM DNS lookup failures and to have implemented their draconian policy without ensuring that has been done, is extremely remiss!

[#8]

Thanks, @MisterW

That seems a big step towards understanding the cause of the problem, though it's still not clear (to me at least) why emails to multiple recipients are more likely to be affected.

Nor, of course, is it clear whether MS are likely to do anything about it, if it's a preexisting problem that they've not addressed previously. But it would be good to have confirmation that PN (and other affected mail providers?) are pressing them.

[#9]

OK, thank you @MisterW.

Meanwhile today I've encountered a new email sending error.  I'll give it here in case it somehow relates to this authentication problem but if it's not, please can you / another Superuser (@Townman?)  split this post into a new topic.

Yesterday I checked on my POP3 settings in Outlook 2016, to ensure they were set as I thought they were (to have outgoing mail to require authentication, using the same settings as incoming mail).  They were.

Today, having just sent a message, but not to an MS account, I got the error shown in the screenshot.  My message was sent and gave no bounce when I clicked 'Yes'.

What's happened to trigger this error, and how do I fix it?

[#10]

@Tim-J 

That seems a big step towards understanding the cause of the problem,

I wouldnt say that yet!. All I can say for definite is that both myself and a family member have domains hosted elsewhere (in fact Mythic Beasts) and have our DMARC records set to send aggregate reports. In reports received from Microsoft we sometimes see DKIM failures with DKIM temperror being reported. We dont see them in reports from other receivers e.g google. In the case of the family member, he sends a monthly club newsletter to a distribution list containing >1 hotmail addresses. He regularly sees the DKIM temperror in the DMARC report as a result of this.

though it's still not clear (to me at least) why emails to multiple recipients are more likely to be affected.

Simple answer is I don't know either BUT with multiple emails being received 'simultaneously' the rate at which DNS lookups are made or accepted COULD be subject to some rate limiting to prevent such things as DDOS attempts 

[#11]

This is the 3rd attempt to get this posted, the posts have been vanishing.


We have MS Outlook and use distribution lists to address the Trustees of a charity, 3 emails are Microsoft accounts.  
Sending messages using the distribution list resuts in immediate bounce messages from each Microsoft email address.

The reality is we are in exactly the same position as when this started
whenever a distribution list contains multiple Microsoft email addresses each MS email fails.

The rejection details follow, let me know if more info is required :

Final-recipient: rfc822; xxxxxx@hotmail.com
 Spf= Pass , Dkim= Fail , DMARC= Pass

Final-recipient: rfc822; xxxxxx@msn.com
 Spf= Pass , Dkim= Fail , DMARC= Pass

Final-recipient: rfc822; xxxxxx@outlook.com
Spf= Pass , Dkim= Fail , DMARC= Pass

[#12]

With e-mails failing on a daily basis, I am starting to feel annoyed with the duration of the problem and the lack of real official updates from Plusnet.

It's no good saying that we should set up a new e-mail account somewhere, everyone knows how much of a problem that will be for us.

This just needs resolving urgently and not by having to wait for Plusnet's new e-mail service provider.

[#13]

I have not read anything to suggest the migration to Greenby is part of the solution to rejection by Microsoft email platform.

[#14]

@PhilipHeyes Neither have I  - not surprising really, because it isn't.

[#15]

There was a comment in this thread a few days ago about waiting till September as Plusnet didn't want to invest in a solution given the move of their mail service.